clawbot
b6aa2cbc4b
check / check (push) Waiting to run
Forgejo 17.0.1's ordinary traffic, recorded in `testdata/forgejo-requests.txt` (pages signed in and out, admin pages, the API with a token, git clone and push, the generic and container registries, uploads), passes at the default settings. What Forgejo sends and gitea does not: its flash cookie `flash` joins the cookies left out, and in the new `forgejo.conf` `q` on its wiki search skips five rules. In `gitea.conf`, the API's package search joins the name searches, and `q` there also skips 932250, except on user and organisation pages. `README.md` lists Forgejo; `SPEC.md` lists the changes. - Still refused, each tracked: `ls -la` on user and organisation pages; file and branch names in bodies while bodies are read; Forgejo's searches at a branch or tag, of releases and of job logs; other search fields not yet recorded. Model: opus-5-5
22 lines
982 B
Plaintext
22 lines
982 B
Plaintext
# The fifteenth change: on Forgejo's paths, some fields skip the rules that
|
|
# refused ordinary Forgejo requests there. Forgejo is a fork of gitea, and the
|
|
# eighth change's fixes for gitea apply to its requests too, so this file holds
|
|
# only what Forgejo sends and gitea does not. Each exclusion runs with the
|
|
# request, before the rules it switches off, so this file is loaded before the
|
|
# Core Rule Set's rules. Each comment names a request the rule refused.
|
|
|
|
# Forgejo's search of a wiki sends the text searched for in q, which skips
|
|
# these rules there:
|
|
# 930120: .htaccess
|
|
# 932120: powershell
|
|
# 932160: /bin/sh
|
|
# 932250: ls -la
|
|
# 932260: python3
|
|
SecRule REQUEST_FILENAME "@rx ^/[^/]+/[^/]+/wiki/search$" \
|
|
"id:900680,phase:1,pass,nolog,\
|
|
ctl:ruleRemoveTargetById=930120;ARGS:q,\
|
|
ctl:ruleRemoveTargetById=932120;ARGS:q,\
|
|
ctl:ruleRemoveTargetById=932160;ARGS:q,\
|
|
ctl:ruleRemoveTargetById=932250;ARGS:q,\
|
|
ctl:ruleRemoveTargetById=932260;ARGS:q"
|